<!DOCTYPE html>
<html lang="en-us">
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    
<meta charset="UTF-8">
<title>Logging configuration | Elasticsearch Guide [7.7] | Elastic</title>
<link rel="home" href="index.html" title="Elasticsearch Guide [7.7]">
<link rel="up" href="settings.html" title="Configuring Elasticsearch">
<link rel="prev" href="modules-gateway.html" title="Local gateway settings">
<link rel="next" href="ml-settings.html" title="Machine learning settings in Elasticsearch">
<meta name="DC.type" content="Learn/Docs/Elasticsearch/Reference/7.7">
<meta name="DC.subject" content="Elasticsearch">
<meta name="DC.identifier" content="7.7">
<meta name="robots" content="noindex,nofollow">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd">
    <meta name="yandex-verification" content="d8a47e95d0972434">
    <meta name="localized" content="true">
    <meta name="st:robots" content="follow,index">
    <meta property="og:image" content="https://www.elastic.co/static/images/elastic-logo-200.png">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles.css">
  </head>

  <!--© 2015-2021 Elasticsearch B.V. Copying, publishing and/or distributing without written permission is strictly prohibited.-->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!--BEGIN QUALTRICS WEBSITE FEEDBACK SNIPPET-->
    <script type="text/javascript">
      (function(){var g=function(e,h,f,g){
      this.get=function(a){for(var a=a+"=",c=document.cookie.split(";"),b=0,e=c.length;b<e;b++){for(var d=c[b];" "==d.charAt(0);)d=d.substring(1,d.length);if(0==d.indexOf(a))return d.substring(a.length,d.length)}return null};
      this.set=function(a,c){var b="",b=new Date;b.setTime(b.getTime()+6048E5);b="; expires="+b.toGMTString();document.cookie=a+"="+c+b+"; path=/; "};
      this.check=function(){var a=this.get(f);if(a)a=a.split(":");else if(100!=e)"v"==h&&(e=Math.random()>=e/100?0:100),a=[h,e,0],this.set(f,a.join(":"));else return!0;var c=a[1];if(100==c)return!0;switch(a[0]){case "v":return!1;case "r":return c=a[2]%Math.floor(100/c),a[2]++,this.set(f,a.join(":")),!c}return!0};
      this.go=function(){if(this.check()){var a=document.createElement("script");a.type="text/javascript";a.src=g;document.body&&document.body.appendChild(a)}};
      this.start=function(){var a=this;window.addEventListener?window.addEventListener("load",function(){a.go()},!1):window.attachEvent&&window.attachEvent("onload",function(){a.go()})}};
      try{(new g(100,"r","QSI_S_ZN_emkP0oSe9Qrn7kF","https://znemkp0ose9qrn7kf-elastic.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_emkP0oSe9Qrn7kF")).start()}catch(i){}})();
    </script><div id="ZN_emkP0oSe9Qrn7kF"><!--DO NOT REMOVE-CONTENTS PLACED HERE--></div>
    <!--END WEBSITE FEEDBACK SNIPPET-->

    <div id="elastic-nav" style="display:none;"></div>
    <script src="https://www.elastic.co/elastic-nav.js"></script>

    <!-- Subnav -->
    <div>
      <div>
        <div class="tertiary-nav d-none d-md-block">
          <div class="container">
            <div class="p-t-b-15 d-flex justify-content-between nav-container">
              <div class="breadcrum-wrapper"><span><a href="/guide/" style="font-size: 14px; font-weight: 600; color: #000;">Docs</a></span></div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div class="main-container">
      <section id="content">
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container">
              <div class="row">
                <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                  <!-- start body -->
                  <div class="page_header">
<strong>IMPORTANT</strong>: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
<a href="../current/index.html">current release documentation</a>.
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="setup.html">Set up Elasticsearch</a></span>
»
<span class="breadcrumb-link"><a href="settings.html">Configuring Elasticsearch</a></span>
»
<span class="breadcrumb-node">Logging configuration</span>
</div>
<div class="navheader">
<span class="prev">
<a href="modules-gateway.html">« Local gateway settings</a>
</span>
<span class="next">
<a href="ml-settings.html">Machine learning settings in Elasticsearch »</a>
</span>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="logging"></a>Logging configuration<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/setup/logging-config.asciidoc">edit</a>
</h2>
</div></div></div>
<p>Elasticsearch uses <a href="https://logging.apache.org/log4j/2.x/" class="ulink" target="_top">Log4j 2</a> for
logging. Log4j 2 can be configured using the log4j2.properties
file. Elasticsearch exposes three properties, <code class="literal">${sys:es.logs.base_path}</code>,
<code class="literal">${sys:es.logs.cluster_name}</code>, and <code class="literal">${sys:es.logs.node_name}</code> that can be
referenced in the configuration file to determine the location of the log
files. The property <code class="literal">${sys:es.logs.base_path}</code> will resolve to the log directory,
<code class="literal">${sys:es.logs.cluster_name}</code> will resolve to the cluster name (used as the
prefix of log filenames in the default configuration), and
<code class="literal">${sys:es.logs.node_name}</code> will resolve to the node name (if the node name is
explicitly set).</p>
<p>For example, if your log directory (<code class="literal">path.logs</code>) is <code class="literal">/var/log/elasticsearch</code> and
your cluster is named <code class="literal">production</code> then <code class="literal">${sys:es.logs.base_path}</code> will resolve
to <code class="literal">/var/log/elasticsearch</code> and
<code class="literal">${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}.log</code>
will resolve to <code class="literal">/var/log/elasticsearch/production.log</code>.</p>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">######## Server JSON ############################
appender.rolling.type = RollingFile <a id="CO9-1"></a><i class="conum" data-value="1"></i>
appender.rolling.name = rolling
appender.rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_server.json <a id="CO9-2"></a><i class="conum" data-value="2"></i>
appender.rolling.layout.type = ESJsonLayout <a id="CO9-3"></a><i class="conum" data-value="3"></i>
appender.rolling.layout.type_name = server <a id="CO9-4"></a><i class="conum" data-value="4"></i>
appender.rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}-%i.json.gz <a id="CO9-5"></a><i class="conum" data-value="5"></i>
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy <a id="CO9-6"></a><i class="conum" data-value="6"></i>
appender.rolling.policies.time.interval = 1 <a id="CO9-7"></a><i class="conum" data-value="7"></i>
appender.rolling.policies.time.modulate = true <a id="CO9-8"></a><i class="conum" data-value="8"></i>
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy <a id="CO9-9"></a><i class="conum" data-value="9"></i>
appender.rolling.policies.size.size = 256MB <a id="CO9-10"></a><i class="conum" data-value="10"></i>
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.fileIndex = nomax
appender.rolling.strategy.action.type = Delete <a id="CO9-11"></a><i class="conum" data-value="11"></i>
appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path}
appender.rolling.strategy.action.condition.type = IfFileName <a id="CO9-12"></a><i class="conum" data-value="12"></i>
appender.rolling.strategy.action.condition.glob = ${sys:es.logs.cluster_name}-* <a id="CO9-13"></a><i class="conum" data-value="13"></i>
appender.rolling.strategy.action.condition.nested_condition.type = IfAccumulatedFileSize <a id="CO9-14"></a><i class="conum" data-value="14"></i>
appender.rolling.strategy.action.condition.nested_condition.exceeds = 2GB <a id="CO9-15"></a><i class="conum" data-value="15"></i>
################################################</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>Configure the <code class="literal">RollingFile</code> appender</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>Log to <code class="literal">/var/log/elasticsearch/production_server.json</code></p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-3"><i class="conum" data-value="3"></i></a></p>
</td>
<td align="left" valign="top">
<p>Use JSON layout.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-4"><i class="conum" data-value="4"></i></a></p>
</td>
<td align="left" valign="top">
<p><code class="literal">type_name</code> is a flag populating the <code class="literal">type</code> field in a <code class="literal">ESJsonLayout</code>.
It can be used to distinguish different types of logs more easily when parsing them.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-5"><i class="conum" data-value="5"></i></a></p>
</td>
<td align="left" valign="top">
<p>Roll logs to <code class="literal">/var/log/elasticsearch/production-yyyy-MM-dd-i.json</code>; logs
will be compressed on each roll and <code class="literal">i</code> will be incremented</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-6"><i class="conum" data-value="6"></i></a></p>
</td>
<td align="left" valign="top">
<p>Use a time-based roll policy</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-7"><i class="conum" data-value="7"></i></a></p>
</td>
<td align="left" valign="top">
<p>Roll logs on a daily basis</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-8"><i class="conum" data-value="8"></i></a></p>
</td>
<td align="left" valign="top">
<p>Align rolls on the day boundary (as opposed to rolling every twenty-four
hours)</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-9"><i class="conum" data-value="9"></i></a></p>
</td>
<td align="left" valign="top">
<p>Using a size-based roll policy</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-10"><i class="conum" data-value="10"></i></a></p>
</td>
<td align="left" valign="top">
<p>Roll logs after 256 MB</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-11"><i class="conum" data-value="11"></i></a></p>
</td>
<td align="left" valign="top">
<p>Use a delete action when rolling logs</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-12"><i class="conum" data-value="12"></i></a></p>
</td>
<td align="left" valign="top">
<p>Only delete logs matching a file pattern</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-13"><i class="conum" data-value="13"></i></a></p>
</td>
<td align="left" valign="top">
<p>The pattern is to only delete the main logs</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-14"><i class="conum" data-value="14"></i></a></p>
</td>
<td align="left" valign="top">
<p>Only delete if we have accumulated too many compressed logs</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-15"><i class="conum" data-value="15"></i></a></p>
</td>
<td align="left" valign="top">
<p>The size condition on the compressed logs is 2 GB</p>
</td>
</tr>
</table>
</div>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">######## Server -  old style pattern ###########
appender.rolling_old.type = RollingFile
appender.rolling_old.name = rolling_old
appender.rolling_old.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_server.log <a id="CO10-1"></a><i class="conum" data-value="1"></i>
appender.rolling_old.layout.type = PatternLayout
appender.rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
appender.rolling_old.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}-%i.old_log.gz</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO10-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>The configuration for <code class="literal">old style</code> pattern appenders. These logs will be saved in <code class="literal">*.log</code> files and if archived will be in <code class="literal">*
.log.gz</code> files. Note that these should be considered deprecated and will be removed in the future.</p>
</td>
</tr>
</table>
</div>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>Log4j’s configuration parsing gets confused by any extraneous whitespace;
if you copy and paste any Log4j settings on this page, or enter any Log4j
configuration in general, be sure to trim any leading and trailing whitespace.</p>
</div>
</div>
<p>Note than you can replace <code class="literal">.gz</code> by <code class="literal">.zip</code> in <code class="literal">appender.rolling.filePattern</code> to
compress the rolled logs using the zip format. If you remove the <code class="literal">.gz</code>
extension then logs will not be compressed as they are rolled.</p>
<p>If you want to retain log files for a specified period of time, you can use a
rollover strategy with a delete action.</p>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">appender.rolling.strategy.type = DefaultRolloverStrategy <a id="CO11-1"></a><i class="conum" data-value="1"></i>
appender.rolling.strategy.action.type = Delete <a id="CO11-2"></a><i class="conum" data-value="2"></i>
appender.rolling.strategy.action.basepath = ${sys:es.logs.base_path} <a id="CO11-3"></a><i class="conum" data-value="3"></i>
appender.rolling.strategy.action.condition.type = IfFileName <a id="CO11-4"></a><i class="conum" data-value="4"></i>
appender.rolling.strategy.action.condition.glob = ${sys:es.logs.cluster_name}-* <a id="CO11-5"></a><i class="conum" data-value="5"></i>
appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified <a id="CO11-6"></a><i class="conum" data-value="6"></i>
appender.rolling.strategy.action.condition.nested_condition.age = 7D <a id="CO11-7"></a><i class="conum" data-value="7"></i></pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO11-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>Configure the <code class="literal">DefaultRolloverStrategy</code></p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO11-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>Configure the <code class="literal">Delete</code> action for handling rollovers</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO11-3"><i class="conum" data-value="3"></i></a></p>
</td>
<td align="left" valign="top">
<p>The base path to the Elasticsearch logs</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO11-4"><i class="conum" data-value="4"></i></a></p>
</td>
<td align="left" valign="top">
<p>The condition to apply when handling rollovers</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO11-5"><i class="conum" data-value="5"></i></a></p>
</td>
<td align="left" valign="top">
<p>Delete files from the base path matching the glob
<code class="literal">${sys:es.logs.cluster_name}-*</code>; this is the glob that log files are rolled
to; this is needed to only delete the rolled Elasticsearch logs but not also
delete the deprecation and slow logs</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO11-6"><i class="conum" data-value="6"></i></a></p>
</td>
<td align="left" valign="top">
<p>A nested condition to apply to files matching the glob</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO11-7"><i class="conum" data-value="7"></i></a></p>
</td>
<td align="left" valign="top">
<p>Retain logs for seven days</p>
</td>
</tr>
</table>
</div>
<p>Multiple configuration files can be loaded (in which case they will get merged)
as long as they are named <code class="literal">log4j2.properties</code> and have the Elasticsearch config
directory as an ancestor; this is useful for plugins that expose additional
loggers. The logger section contains the java packages and their corresponding
log level. The appender section contains the destinations for the logs.
Extensive information on how to customize logging and all the supported
appenders can be found on the
<a href="http://logging.apache.org/log4j/2.x/manual/configuration.html" class="ulink" target="_top">Log4j
documentation</a>.</p>
<h3>
<a id="configuring-logging-levels"></a>Configuring logging levels<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/setup/logging-config.asciidoc">edit</a>
</h3>
<p>There are four ways to configuring logging levels, each having situations in which they are appropriate to use.</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
Via the command-line: <code class="literal">-E &lt;name of logging hierarchy&gt;=&lt;level&gt;</code> (e.g.,
<code class="literal">-E logger.org.elasticsearch.discovery=debug</code>). This is most appropriate when
you are temporarily debugging a problem on a single node (for example, a
problem with startup, or during development).
</li>
<li class="listitem">
Via <code class="literal">elasticsearch.yml</code>: <code class="literal">&lt;name of logging hierarchy&gt;: &lt;level&gt;</code> (e.g.,
<code class="literal">logger.org.elasticsearch.discovery: debug</code>). This is most appropriate when
you are temporarily debugging a problem but are not starting Elasticsearch
via the command-line (e.g., via a service) or you want a logging level
adjusted on a more permanent basis.
</li>
<li class="listitem">
<p>Via <a class="xref" href="modules-cluster.html#cluster-logger" title="Logger">cluster settings</a>:</p>
<div class="pre_wrapper lang-js">
<pre class="programlisting prettyprint lang-js">PUT /_cluster/settings
{
  "transient": {
    "&lt;name of logging hierarchy&gt;": "&lt;level&gt;"
  }
}</pre>
</div>
<p>For example:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT /_cluster/settings
{
  "transient": {
    "logger.org.elasticsearch.discovery": "DEBUG"
  }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/27.console"></div>
<p>This is most appropriate when you need to dynamically need to adjust a logging
level on an actively-running cluster.</p>
</li>
<li class="listitem">
<p>Via the <code class="literal">log4j2.properties</code>:</p>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">logger.&lt;unique_identifier&gt;.name = &lt;name of logging hierarchy&gt;
logger.&lt;unique_identifier&gt;.level = &lt;level&gt;</pre>
</div>
<p>For example:</p>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">logger.discovery.name = org.elasticsearch.discovery
logger.discovery.level = debug</pre>
</div>
<p>This is most appropriate when you need fine-grained control over the logger (for
example, you want to send the logger to another file, or manage the logger
differently; this is a rare use-case).</p>
</li>
</ol>
</div>
<h3>
<a id="deprecation-logging"></a>Deprecation logging<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/setup/logging-config.asciidoc">edit</a>
</h3>
<p>In addition to regular logging, Elasticsearch allows you to enable logging
of deprecated actions. For example this allows you to determine early, if
you need to migrate certain functionality in the future. By default,
deprecation logging is enabled at the WARN level, the level at which all
deprecation log messages will be emitted.</p>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">logger.deprecation.level = warn</pre>
</div>
<p>This will create a daily rolling deprecation log file in your log directory.
Check this file regularly, especially when you intend to upgrade to a new
major version.</p>
<p>The default logging configuration has set the roll policy for the deprecation
logs to roll and compress after 1 GB, and to preserve a maximum of five log
files (four rolled logs, and the active log).</p>
<p>You can disable it in the <code class="literal">config/log4j2.properties</code> file by setting the deprecation
log level to <code class="literal">error</code> like this:</p>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">logger.deprecation.name = org.elasticsearch.deprecation
logger.deprecation.level = error</pre>
</div>
<p>You can identify what is triggering deprecated functionality if <code class="literal">X-Opaque-Id</code> was used as an HTTP header.
The user ID is included in the <code class="literal">X-Opaque-ID</code> field in deprecation JSON logs.</p>
<div class="pre_wrapper lang-js">
<pre class="programlisting prettyprint lang-js">{
  "type": "deprecation",
  "timestamp": "2019-08-30T12:07:07,126+02:00",
  "level": "WARN",
  "component": "o.e.d.r.a.a.i.RestCreateIndexAction",
  "cluster.name": "distribution_run",
  "node.name": "node-0",
  "message": "[types removal] Using include_type_name in create index requests is deprecated. The parameter will be removed in the next major version.",
  "x-opaque-id": "MY_USER_ID",
  "cluster.uuid": "Aq-c-PAeQiK3tfBYtig9Bw",
  "node.id": "D7fUYfnfTLa2D7y-xw6tZg"
}</pre>
</div>
<h3>
<a id="json-logging"></a>JSON log format<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/setup/logging-config.asciidoc">edit</a>
</h3>
<p>To make parsing Elasticsearch logs easier, logs are now printed in a JSON format.
This is configured by a Log4J layout property <code class="literal">appender.rolling.layout.type = ESJsonLayout</code>.
This layout requires a <code class="literal">type_name</code> attribute to be set which is used to distinguish
logs streams when parsing.</p>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">appender.rolling.layout.type = ESJsonLayout
appender.rolling.layout.type_name = server</pre>
</div>
<p>Each line contains a single JSON document with the properties configured in <code class="literal">ESJsonLayout</code>.
See this class <a href="https://artifacts.elastic.co/javadoc/org/elasticsearch/elasticsearch/7.7.1/org/elasticsearch/common/logging/ESJsonLayout.html" class="ulink" target="_top">javadoc</a> for more details.
However if a JSON document contains an exception, it will be printed over multiple lines.
The first line will contain regular properties and subsequent lines will contain the
stacktrace formatted as a JSON array.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>You can still use your own custom layout. To do that replace the line
<code class="literal">appender.rolling.layout.type</code> with a different layout. See sample below:</p>
</div>
</div>
<div class="pre_wrapper lang-properties">
<pre class="programlisting prettyprint lang-properties">appender.rolling.type = RollingFile
appender.rolling.name = rolling
appender.rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_server.log
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %.-10000m%n
appender.rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}-%i.log.gz</pre>
</div>
</div>
<div class="navfooter">
<span class="prev">
<a href="modules-gateway.html">« Local gateway settings</a>
</span>
<span class="next">
<a href="ml-settings.html">Machine learning settings in Elasticsearch »</a>
</span>
</div>
</div>

                  <!-- end body -->
                </div>
                <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                  <div id="rtpcontainer" style="display: block;">
                    <div class="mktg-promo">
                      <h3>Most Popular</h3>
                      <ul class="icons">
                        <li class="icon-elasticsearch-white"><a href="https://www.elastic.co/webinars/getting-started-elasticsearch?baymax=default&amp;elektra=docs&amp;storm=top-video">Get Started with Elasticsearch: Video</a></li>
                        <li class="icon-kibana-white"><a href="https://www.elastic.co/webinars/getting-started-kibana?baymax=default&amp;elektra=docs&amp;storm=top-video">Intro to Kibana: Video</a></li>
                        <li class="icon-logstash-white"><a href="https://www.elastic.co/webinars/introduction-elk-stack?baymax=default&amp;elektra=docs&amp;storm=top-video">ELK for Logs &amp; Metrics: Video</a></li>
                      </ul>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


<div id="elastic-footer"></div>
<script src="https://www.elastic.co/elastic-footer.js"></script>
<!-- Footer Section end-->

      </section>
    </div>

<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs.js"></script>
<script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>
